@flaredev/cli 0.1.1 → 0.2.0

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import pc18 from "picocolors";
+import pc19 from "picocolors";
 
 // src/cli.ts
 import { cac } from "cac";
@@ -14,34 +14,85 @@ import { FLARE_VERSION } from "@flaredev/core";
 
 // src/auth-providers.ts
 var AUTH_PROVIDERS = {
-  google: { envPrefix: "GOOGLE", console: "https://console.cloud.google.com/apis/credentials" },
-  github: { envPrefix: "GITHUB", console: "https://github.com/settings/developers" }
+  google: { label: "Google", envPrefix: "GOOGLE", console: "https://console.cloud.google.com/apis/credentials", extra: [] },
+  github: { label: "GitHub", envPrefix: "GITHUB", console: "https://github.com/settings/developers", extra: [] },
+  apple: {
+    label: "Apple",
+    envPrefix: "APPLE",
+    console: "https://developer.apple.com/account/resources/identifiers/list/serviceId",
+    // The client secret is a JWT signed with your key; the bundle id is only for native apps.
+    extra: ["# APPLE_CLIENT_SECRET is a JWT you generate from your Sign in with Apple key (see the auth guide).", "APPLE_APP_BUNDLE_ID="]
+  },
+  microsoft: {
+    label: "Microsoft",
+    envPrefix: "MICROSOFT",
+    console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+    extra: ['# "common" (the default) accepts personal and work accounts; a tenant id limits sign-in to one organisation.', "MICROSOFT_TENANT_ID="]
+  }
 };
-function parseAuthProviders(input) {
-  if (!input) return [];
+var AUTH_METHODS = {
+  "magic-link": "Magic links (a sign-in link by email)",
+  "email-otp": "Email codes (a 6-digit sign-in code)",
+  passkeys: "Passkeys (Face ID, Touch ID, Windows Hello)",
+  "2fa-app": "Two-factor with an authenticator app, plus backup codes",
+  "2fa-email": "Two-factor with codes by email"
+};
+var DEFAULT_AUTH_METHODS = ["magic-link", "email-otp", "passkeys", "2fa-app", "2fa-email"];
+function parseList(input, known, what) {
   const names = input.split(",").map((name) => name.trim().toLowerCase()).filter(Boolean);
-  const unknown = names.filter((name) => !(name in AUTH_PROVIDERS));
+  const unknown = names.filter((name) => !known.includes(name));
   if (unknown.length > 0) {
-    throw new Error(
-      `Unknown auth provider${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${Object.keys(AUTH_PROVIDERS).join(", ")}.`
-    );
+    throw new Error(`Unknown ${what}${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")}. Supported: ${known.join(", ")}.`);
   }
   return [...new Set(names)];
 }
-function socialProvidersCode(providers) {
-  if (providers.length === 0) return "{}";
-  const entries = providers.map((provider) => {
-    const id = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID`;
-    const secret = `env.${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET`;
-    return `    ...(${id} && ${secret} ? { ${provider}: { clientId: ${id}, clientSecret: ${secret} } } : {}),`;
-  });
-  return [
-    "{",
-    "    // Each provider switches on once its credentials are set: .dev.vars locally,",
-    "    // `wrangler secret put` in production.",
-    ...entries,
-    "  }"
-  ].join("\n");
+function parseAuthProviders(input) {
+  if (!input) return [];
+  return parseList(input, Object.keys(AUTH_PROVIDERS), "auth provider");
+}
+function parseAuthMethods(input) {
+  if (input === void 0) return DEFAULT_AUTH_METHODS;
+  const value = input.trim().toLowerCase();
+  if (value === "all") return [...DEFAULT_AUTH_METHODS];
+  if (value === "none" || value === "") return [];
+  return parseList(value, Object.keys(AUTH_METHODS), "sign-in method");
+}
+function renderAuthConfig(methods, providers) {
+  const on = (method) => methods.includes(method);
+  return `/**
+ * How people sign in to this app. \`flare create\` wrote the choices you made; change
+ * them here any time. Every method's tables already exist, so switching one on or off
+ * needs no migration, and a method that's off is refused by the API, not just hidden.
+ *
+ * Email and password sign-in is always available.
+ */
+export const authConfig = {
+  /** A sign-in link by email. */
+  magicLink: ${on("magic-link")},
+  /** A 6-digit sign-in code by email. */
+  emailOtp: ${on("email-otp")},
+  /** Face ID, Touch ID, Windows Hello or a security key. */
+  passkeys: ${on("passkeys")},
+  twoFactor: {
+    /** Codes from an authenticator app (TOTP), with backup codes. */
+    authenticator: ${on("2fa-app")},
+    /** Codes by email as the second step. */
+    email: ${on("2fa-email")},
+  },
+  /**
+   * Social sign-in. Each provider also needs its credentials (see .dev.vars.example);
+   * without them its button stays hidden.
+   */
+  social: ${JSON.stringify(providers).replace(/","/g, '", "')} as SocialProvider[],
+  /** Refuse password sign-in until the email address is verified. */
+  requireEmailVerification: false,
+};
+
+export type SocialProvider = "google" | "github" | "apple" | "microsoft";
+
+/** Whether any second factor can be set up. */
+export const twoFactorAvailable = authConfig.twoFactor.authenticator || authConfig.twoFactor.email;
+`;
 }
 function devVarsEntries(providers) {
   return providers.map((provider) => `${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_ID=
@@ -50,21 +101,39 @@ ${AUTH_PROVIDERS[provider].envPrefix}_CLIENT_SECRET=
 }
 function devVarsExampleEntries(providers) {
   return providers.map((provider) => {
-    const { envPrefix, console: console2 } = AUTH_PROVIDERS[provider];
+    const { label, envPrefix, console: console2, extra } = AUTH_PROVIDERS[provider];
     return [
       "",
-      `# ${provider} OAuth app: ${console2}`,
+      `# ${label} sign-in: ${console2}`,
       `# Callback URL: <your app URL>/api/auth/callback/${provider}`,
       `${envPrefix}_CLIENT_ID=`,
       `${envPrefix}_CLIENT_SECRET=`,
+      ...extra,
       ""
     ].join("\n");
   }).join("");
 }
 
+// src/themes.ts
+var THEMES = {
+  default: "Calm and centred, indigo accents",
+  coral: "Warm and rounded, sign-in as a card over the page",
+  amber: "Plain and direct, boxed forms with pill buttons",
+  sky: "Crisp blue, bold headings, social sign-in first",
+  mono: "Black and white on a fine grid",
+  emerald: "Fresh green, sign-in beside a customer quote"
+};
+function parseTheme(value) {
+  if (value === void 0) return "default";
+  const name = value.trim().toLowerCase();
+  if (!(name in THEMES)) throw new Error(`Unknown theme "${value}". Themes: ${Object.keys(THEMES).join(", ")}.`);
+  return name;
+}
+
 // src/versions.ts
 var APP_DEPENDENCIES = {
   "@better-auth/drizzle-adapter": "1.7.5",
+  "@better-auth/passkey": "1.7.5",
   // Server components import Slot from here rather than the "radix-ui" umbrella (see components/ui/button.tsx).
   "@radix-ui/react-slot": "1.3.3",
   "@vinext/cloudflare": "1.0.0-beta.8",
@@ -80,6 +149,14 @@ var APP_DEPENDENCIES = {
   sonner: "^2.0.8",
   "tailwind-merge": "^3.7.0",
   "tw-animate-css": "^1.4.0",
+  // Typefaces for the six themes (app/globals.css).
+  "@fontsource-variable/figtree": "5.3.0",
+  "@fontsource-variable/geist": "5.3.0",
+  "@fontsource-variable/inter": "5.3.0",
+  "@fontsource-variable/noto-sans": "5.3.0",
+  "@fontsource-variable/plus-jakarta-sans": "5.3.0",
+  // QR codes for authenticator-app (2FA) setup.
+  uqr: "0.1.3",
   "drizzle-orm": "^0.45.2",
   react: "19.3.0",
   "react-dom": "19.3.0",
@@ -157,6 +234,15 @@ function childEnv(env = process.env) {
   }
   return next;
 }
+function runQuiet(command, args, cwd) {
+  const env = childEnv();
+  const result = process.platform === "win32" ? spawnSync([command, ...args].join(" "), { cwd, env, shell: true, encoding: "utf8" }) : spawnSync(command, args, { cwd, env, encoding: "utf8" });
+  return { code: result.status ?? 1, output: `${result.stdout ?? ""}${result.stderr ?? ""}` };
+}
+function installArgs(pm) {
+  if (pm === "npm") return ["install", "--no-audit", "--no-fund", "--loglevel=error"];
+  return ["install"];
+}
 
 // src/commands/create.ts
 function toAppName(dir) {
@@ -185,14 +271,17 @@ function createApp(target, options2 = {}) {
   }
   const packageManager = options2.pm ?? detectPackageManager();
   const authProviders = parseAuthProviders(options2.authProviders);
+  const authMethods = parseAuthMethods(options2.auth);
+  const theme = parseTheme(options2.theme);
   const inWorkspace = findUp("pnpm-workspace.yaml", dirname2(dir)) !== void 0;
   const compatibilityDate = options2.compatibilityDate ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   copyTemplate(join2(templatesDir, "app"), dir, {
     APP_NAME: name,
     COMPAT_DATE: compatibilityDate,
     PM: packageManager,
-    SOCIAL_PROVIDERS: socialProvidersCode(authProviders)
+    THEME: theme
   });
+  writeFileSync2(join2(dir, "lib", "auth-config.ts"), renderAuthConfig(authMethods, authProviders));
   appendFileSync(join2(dir, ".dev.vars.example"), devVarsExampleEntries(authProviders));
   writeJson(join2(dir, "package.json"), {
     name,
@@ -221,24 +310,42 @@ ${devVarsEntries(authProviders)}`
   if (packageManager === "pnpm" && !inWorkspace) {
     writeFileSync2(join2(dir, "pnpm-workspace.yaml"), "allowBuilds:\n  esbuild: true\n  workerd: true\n  sharp: false\n");
   }
+  const log = options2.log ?? ((message) => console.log(message));
   if (options2.install !== false) {
-    const code = run(packageManager, ["install"], dir);
+    log(`${pc.green("\u2714")} Wrote the app to ${relative(process.cwd(), dir) || "."}`);
+    log(`${pc.cyan("\u25CF")} Installing dependencies with ${packageManager}. The first install downloads the Workers runtime and toolchain, so it can take a few minutes.
+`);
+    const started = Date.now();
+    const code = run(packageManager, installArgs(packageManager), dir);
     if (code !== 0) throw new Error(`${packageManager} install failed (exit code ${code}).`);
-    const typegen = run(packageManager, ["run", "cf-typegen"], dir);
-    if (typegen !== 0) throw new Error(`wrangler types failed (exit code ${typegen}).`);
+    log(`${pc.green("\u2714")} Installed dependencies ${pc.dim(`(${formatDuration(Date.now() - started)})`)}`);
+    const typegen = runQuiet(packageManager, ["run", "cf-typegen"], dir);
+    if (typegen.code !== 0) {
+      process.stderr.write(typegen.output);
+      throw new Error(`wrangler types failed (exit code ${typegen.code}).`);
+    }
+    log(`${pc.green("\u2714")} Generated types for the Cloudflare bindings`);
   }
   return { dir, name, packageManager, inWorkspace };
 }
+function formatDuration(ms) {
+  const seconds = Math.round(ms / 1e3);
+  return seconds < 60 ? `${seconds}s` : `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+}
 function printNextSteps(result, installed) {
   const rel = relative(process.cwd(), result.dir) || ".";
   const pm = result.packageManager;
+  const step = (command, note) => `  ${command.padEnd(30)}${pc.dim(note)}`;
   console.log(`
-${pc.green("\u2714")} Created ${pc.bold(result.name)} in ${rel}
+${pc.green("\u2714")} Created ${pc.bold(result.name)}
 `);
   console.log("Next steps:");
   console.log(`  cd ${rel}`);
   if (!installed) console.log(`  ${pm} install`);
-  console.log(`  ${pm} run dev`);
+  console.log(step(`${pm} run dev`, "start it at http://localhost:3000"));
+  console.log(step("npx flare gen resource ...", "add your first resource"));
+  console.log(`
+Quickstart: ${pc.cyan("https://flare-docs.codetotech.com/start/quickstart/")}`);
 }
 
 // src/commands/gen-billing.ts
@@ -247,9 +354,10 @@ import { dirname as dirname6, join as join11 } from "path";
 import pc6 from "picocolors";
 
 // src/generator/grammar.ts
-import { camelCase, FILE_CATEGORIES } from "@flaredev/core";
+import { camelCase, FILE_CATEGORIES, STRING_FORMATS } from "@flaredev/core";
 var SIMPLE_KINDS = ["string", "text", "int", "float", "boolean", "date", "datetime"];
-var ALL_KINDS = [...SIMPLE_KINDS, "enum", "file", "belongsTo", "hasMany"];
+var FORMAT_ALIASES = { phone: "tel" };
+var ALL_KINDS = [...SIMPLE_KINDS, ...STRING_FORMATS, "phone", "enum", "select", "radio", "multiselect", "file", "belongsTo", "hasMany"];
 var FieldGrammarError = class extends Error {
   constructor(message) {
     super(message);
@@ -317,15 +425,21 @@ function parseField(spec) {
   let match;
   if (SIMPLE_KINDS.includes(type)) {
     field.kind = type;
-  } else if (match = /^enum\((.*)\)$/.exec(type)) {
-    field.kind = "enum";
-    const options2 = list(match[1], "enum option", spec);
+  } else if (STRING_FORMATS.includes(type) || type in FORMAT_ALIASES) {
+    field.kind = "string";
+    field.format = FORMAT_ALIASES[type] ?? type;
+  } else if (match = /^(enum|select|radio|multiselect)\((.*)\)$/.exec(type)) {
+    const choice = match[1];
+    field.kind = choice === "multiselect" ? "multiselect" : "enum";
+    if (choice === "radio") field.widget = "radio";
+    if (choice === "multiselect" && unique) throw new FieldGrammarError(`"${spec}": multiselect fields can't be unique.`);
+    const options2 = list(match[2], `${choice} option`, spec);
     for (const option of options2) {
       if (!/^[A-Za-z0-9_-]+$/.test(option)) {
-        throw new FieldGrammarError(`"${spec}": enum option "${option}" may only use letters, digits, _ and -.`);
+        throw new FieldGrammarError(`"${spec}": ${choice} option "${option}" may only use letters, digits, _ and -.`);
       }
     }
-    if (new Set(options2).size !== options2.length) throw new FieldGrammarError(`"${spec}": duplicate enum options.`);
+    if (new Set(options2).size !== options2.length) throw new FieldGrammarError(`"${spec}": duplicate ${choice} options.`);
     field.options = options2;
   } else if (match = /^file(?::\[(.*)\])?$/.exec(type)) {
     field.kind = "file";
@@ -360,7 +474,7 @@ function parseField(spec) {
     const base = type.replace(/[([].*$/, "").replace(/:$/, "");
     throw new FieldGrammarError(`"${spec}": unknown type "${type}".${suggest(base, ALL_KINDS)} Types: ${ALL_KINDS.join(", ")}.`);
   }
-  if (field.kind === "string") {
+  if (field.kind === "string" && !field.format) {
     if (/^email$|Email$/.test(key)) field.format = "email";
     else if (/^(url|website)$|(Url|Website)$/.test(key)) field.format = "url";
   }
@@ -478,6 +592,7 @@ function options(field) {
   if (!field.required) opts.required = false;
   if (field.unique) opts.unique = true;
   if (field.format) opts.format = field.format;
+  if (field.widget) opts.widget = field.widget;
   if (field.kind === "belongsTo" && !field.required) opts.onDelete = "set null";
   return opts;
 }
@@ -486,6 +601,8 @@ function toField(field) {
   switch (field.kind) {
     case "enum":
       return builders.enum(field.options, opts);
+    case "multiselect":
+      return builders.multiselect(field.options, opts);
     case "file":
       return builders.file(field.accept, opts);
     case "belongsTo":
@@ -507,6 +624,8 @@ function renderField(field) {
   switch (field.kind) {
     case "enum":
       return `${field.key}: field.enum(${args(literal(field.options), opts)}),`;
+    case "multiselect":
+      return `${field.key}: field.multiselect(${args(literal(field.options), opts)}),`;
     case "file":
       return `${field.key}: field.file(${args(literal(field.accept), opts)}),`;
     case "belongsTo":
@@ -1816,6 +1935,9 @@ function columnExpression(key, def, resources, selfName) {
     case "enum":
       expr = `text(${col}, { enum: ${q(def.options)} })`;
       break;
+    case "multiselect":
+      expr = `text(${col}, { mode: "json" }).$type<(${def.options.map((option) => q(option)).join(" | ")})[]>()`;
+      break;
     case "belongsTo": {
       const target = resources.get(def.target);
       if (!target) {
@@ -1829,7 +1951,7 @@ function columnExpression(key, def, resources, selfName) {
       expr = `text(${col})`;
   }
   if (def.required) expr += ".notNull()";
-  if (def.unique) expr += ".unique()";
+  if ("unique" in def && def.unique) expr += ".unique()";
   if ("default" in def && def.default !== void 0) expr += `.default(${q(def.default)})`;
   return expr;
 }
@@ -2867,11 +2989,83 @@ async function genSecurity(options2 = {}) {
   return { files, migrations, bindings };
 }
 
+// src/commands/theme.ts
+import { existsSync as existsSync14, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { join as join13 } from "path";
+import pc8 from "picocolors";
+var THEME_LINE = /theme: "([a-z]+)" as ThemeName,/;
+function setTheme(name, cwd = process.cwd(), log = console.log) {
+  const appRoot = findAppRoot(cwd);
+  const path = join13(appRoot, "lib/site.ts");
+  if (!existsSync14(path)) throw new Error("lib/site.ts not found: this app was created before themes. Add it from the Flare app template.");
+  const source = readFileSync10(path, "utf8");
+  const current = THEME_LINE.exec(source)?.[1];
+  if (!name) {
+    for (const [theme2, description] of Object.entries(THEMES)) {
+      log(`${theme2 === current ? pc8.green("\u25CF") : " "} ${theme2.padEnd(8)} ${pc8.dim(description)}`);
+    }
+    log(pc8.dim("\nSwitch with `flare theme <name>`. FLARE_THEME in .env overrides it for a build."));
+    return;
+  }
+  const theme = parseTheme(name);
+  if (!current) throw new Error('lib/site.ts has no `theme: "\u2026" as ThemeName,` line to change.');
+  writeFileSync8(path, source.replace(THEME_LINE, `theme: "${theme}" as ThemeName,`));
+  log(`${pc8.green("\u2714")} Theme is now ${pc8.bold(theme)}. Restart \`flare dev\` (or rebuild) to see it.`);
+}
+
+// src/commands/create-prompts.ts
+import * as prompts from "@clack/prompts";
+var canPrompt = (yes) => !yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+function stopIfCancelled(value) {
+  if (prompts.isCancel(value)) {
+    prompts.cancel("Cancelled: nothing was created.");
+    process.exit(1);
+  }
+  return value;
+}
+async function askCreateQuestions(given) {
+  prompts.intro("Let's set up your Flare app");
+  const answers = { ...given };
+  if (given.theme === void 0) {
+    answers.theme = stopIfCancelled(
+      await prompts.select({
+        message: "Pick a look (change it later in lib/site.ts or with FLARE_THEME)",
+        initialValue: "default",
+        options: Object.entries(THEMES).map(([value, hint]) => ({ value, label: value, hint }))
+      })
+    );
+  }
+  if (given.auth === void 0) {
+    const methods = stopIfCancelled(
+      await prompts.multiselect({
+        message: "How can people sign in? Email and password is always on. (space to toggle)",
+        initialValues: DEFAULT_AUTH_METHODS,
+        required: false,
+        options: Object.entries(AUTH_METHODS).map(([value, label]) => ({ value, label }))
+      })
+    );
+    answers.auth = methods.length ? methods.join(",") : "none";
+  }
+  if (given.authProviders === void 0) {
+    const providers = stopIfCancelled(
+      await prompts.multiselect({
+        message: "Social sign-in? Each needs its own credentials later. (space to toggle, enter to skip)",
+        initialValues: [],
+        required: false,
+        options: Object.entries(AUTH_PROVIDERS).map(([value, { label }]) => ({ value, label }))
+      })
+    );
+    answers.authProviders = providers.join(",");
+  }
+  prompts.outro("Creating your app");
+  return answers;
+}
+
 // src/commands/gen.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join13 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join14 } from "path";
 import { camelCase as camelCase4, defineResource as defineResource2, relationGraph as relationGraph2 } from "@flaredev/core";
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 function validateFields(name, fields, others, log) {
   const known = /* @__PURE__ */ new Set([name, ...others.map((resource) => resource.name)]);
   for (const field of fields) {
@@ -2882,7 +3076,7 @@ function validateFields(name, fields, others, log) {
   const candidate = defineResource2({ name, fields: Object.fromEntries(fields.map((f) => [f.key, toField(f)])) });
   const graph = relationGraph2([...others, candidate]);
   for (const pending of graph.pending.filter((p) => p.resource === name)) {
-    log(pc8.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
+    log(pc9.dim(`note: ${name}.${pending.key} will link up once ${pending.target} exists (give it a ${camelCase4(name)}Id: belongsTo(${name}) field).`));
   }
 }
 async function genResource(rawName, options2) {
@@ -2890,8 +3084,8 @@ async function genResource(rawName, options2) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const name = resourceName(rawName);
   const relativePath = descriptorPath(name);
-  const path = join13(appRoot, relativePath);
-  const exists = existsSync14(path);
+  const path = join14(appRoot, relativePath);
+  const exists = existsSync15(path);
   if (!exists && !options2.fields) {
     throw new Error(`--fields is required, e.g. flare gen resource ${name} --fields "name:string, email:string"`);
   }
@@ -2902,12 +3096,12 @@ async function genResource(rawName, options2) {
     validateFields(name, fields, others, log);
     if (!exists) {
       mkdirSync7(dirname8(path), { recursive: true });
-      writeFileSync8(path, renderDescriptor(name, fields));
-      log(`${pc8.green("create".padEnd(9))} ${relativePath}`);
+      writeFileSync9(path, renderDescriptor(name, fields));
+      log(`${pc9.green("create".padEnd(9))} ${relativePath}`);
     } else {
       try {
         const outcome = writeGenerated(path, renderFieldsBlock(fields), { force: options2.force });
-        log(`${(outcome === "identical" ? pc8.dim : pc8.yellow)(outcome.padEnd(9))} ${relativePath}`);
+        log(`${(outcome === "identical" ? pc9.dim : pc9.yellow)(outcome.padEnd(9))} ${relativePath}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(
@@ -2933,28 +3127,28 @@ async function genResource(rawName, options2) {
   }
   const skipped = written.filter((r) => r.outcome.startsWith("skipped"));
   if (skipped.length) {
-    log(pc8.yellow(`
+    log(pc9.yellow(`
 Skipped ${skipped.length} hand-edited file(s); run \`flare sync-types\` for details.`));
   }
   let migrations = [];
   if (!options2.skipMigration) {
     const result = await generateSchemaMigration(appRoot, `${exists ? "update" : "create"}_${table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc8.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc8.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc9.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc9.dim(`repaired  ${repair}`));
     if (migrations.length) log(`
-Next: ${pc8.bold("flare migrate")} to apply it locally.`);
-    else if (exists) log(pc8.dim("\nNo table changes, so no migration."));
+Next: ${pc9.bold("flare migrate")} to apply it locally.`);
+    else if (exists) log(pc9.dim("\nNo table changes, so no migration."));
   }
   const descriptor = { path: relativePath, status: exists ? "outdated" : "missing", outcome: exists ? "update" : "create" };
   return { name, mode: exists ? "update" : "create", written: [descriptor, ...written], migrations };
 }
 
 // src/commands/gen-migration.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename2, join as join14 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename2, join as join15 } from "path";
 import { snakeCase } from "@flaredev/core";
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 var DOWN_TEMPLATE = (up) => `-- Rollback for ${up}, run by \`flare migrate:rollback\`.
 -- Write SQL that undoes the up migration, e.g.:
 --   DROP INDEX IF EXISTS \`contacts_phone_idx\`;
@@ -2970,31 +3164,31 @@ async function genMigration(rawName, options2 = {}) {
     log(options2.fromSchema ? "No schema changes, so no migration was created." : "drizzle-kit didn't create a migration.");
     return [];
   }
-  for (const file of files) log(`${pc9.green("create".padEnd(9))} ${file}`);
-  for (const repair of repairs) log(pc9.dim(`repaired  ${repair}`));
+  for (const file of files) log(`${pc10.green("create".padEnd(9))} ${file}`);
+  for (const repair of repairs) log(pc10.dim(`repaired  ${repair}`));
   if (!options2.fromSchema) {
-    const downDir = join14(appRoot, "migrations", "down");
+    const downDir = join15(appRoot, "migrations", "down");
     mkdirSync8(downDir, { recursive: true });
     for (const file of files) {
-      const down = join14(downDir, basename2(file));
-      if (existsSync15(down)) continue;
-      writeFileSync9(down, DOWN_TEMPLATE(basename2(file)));
-      log(`${pc9.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
+      const down = join15(downDir, basename2(file));
+      if (existsSync16(down)) continue;
+      writeFileSync10(down, DOWN_TEMPLATE(basename2(file)));
+      log(`${pc10.green("create".padEnd(9))} migrations/down/${basename2(file)}`);
     }
     log(`
-Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc9.bold("flare migrate")}.`);
+Write your SQL in ${files[0]} (and its rollback in migrations/down/), then run ${pc10.bold("flare migrate")}.`);
   } else {
     log(`
-Next: ${pc9.bold("flare migrate")}.`);
+Next: ${pc10.bold("flare migrate")}.`);
   }
   return files;
 }
 
 // src/commands/gen-policy.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname9, join as join15 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 import { definePolicy } from "@flaredev/core";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 function parseRoles(input, what = "--roles") {
   const roles = (input ?? "").split(",").map((role) => role.trim()).filter(Boolean);
   if (roles.length === 0) throw new Error(`${what} is required, e.g. ${what} admin,staff`);
@@ -3010,8 +3204,8 @@ async function genPolicy(rawName, options2) {
     throw new Error(`No resource "${name}". Generate it first. Known resources: ${known}.`);
   }
   const relative2 = policyPath(name);
-  const path = join15(appRoot, relative2);
-  const exists = existsSync16(path);
+  const path = join16(appRoot, relative2);
+  const exists = existsSync17(path);
   let roles;
   let deleteRoles;
   if (options2.roles || !exists) {
@@ -3023,12 +3217,12 @@ async function genPolicy(rawName, options2) {
     const block = renderPolicyBlock({ read: roles, create: roles, update: roles, delete: deleteRoles });
     if (!exists) {
       mkdirSync9(dirname9(path), { recursive: true });
-      writeFileSync10(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
-      log(`${pc10.green("create".padEnd(9))} ${relative2}`);
+      writeFileSync11(path, renderPolicy(name, { read: roles, create: roles, update: roles, delete: deleteRoles }));
+      log(`${pc11.green("create".padEnd(9))} ${relative2}`);
     } else {
       try {
         const outcome = writeGenerated(path, block, { force: options2.force });
-        log(`${(outcome === "identical" ? pc10.dim : pc10.yellow)(outcome.padEnd(9))} ${relative2}`);
+        log(`${(outcome === "identical" ? pc11.dim : pc11.yellow)(outcome.padEnd(9))} ${relative2}`);
       } catch (error) {
         if (error instanceof DriftError) {
           throw new Error(`The roles in ${relative2} were edited by hand, so --roles won't overwrite them. Edit the file directly, or pass --force.`);
@@ -3040,15 +3234,15 @@ async function genPolicy(rawName, options2) {
   const policies = await loadPolicies(appRoot);
   logResults(applyPlan(appRoot, planFiles(resources, policies)), log);
   log(`
-${pc10.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
+${pc11.dim("Roles come from `flare role:add`; the API and the admin both enforce this policy.")}`);
   return { name, path: relative2 };
 }
 
 // src/commands/migrate.ts
-import { existsSync as existsSync17, mkdtempSync, readFileSync as readFileSync10, rmSync as rmSync2, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync18, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
-import pc11 from "picocolors";
+import { join as join17 } from "path";
+import pc12 from "picocolors";
 
 // src/generator/down.ts
 var IDENT = '(`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
@@ -3165,7 +3359,7 @@ async function rollback(options2 = {}) {
   const steps = options2.steps ?? 1;
   if (!Number.isInteger(steps) || steps < 1) throw new Error("--steps must be a positive integer.");
   const { appRoot, db, target, where, wrangler, log } = context(options2);
-  const migrationsDir = join16(appRoot, db.migrations_dir ?? "migrations");
+  const migrationsDir = join17(appRoot, db.migrations_dir ?? "migrations");
   const applied = await appliedMigrations(options2, steps);
   if (applied.length === 0) {
     log("Nothing to roll back.");
@@ -3174,18 +3368,18 @@ async function rollback(options2 = {}) {
   const plan = [];
   for (const { name } of applied) {
     if (!/^[\w.-]+\.sql$/.test(name)) throw new Error(`Unexpected migration name "${name}" in d1_migrations.`);
-    const handWritten = join16(migrationsDir, "down", name);
-    if (existsSync17(handWritten)) {
-      const sql2 = readFileSync10(handWritten, "utf8");
+    const handWritten = join17(migrationsDir, "down", name);
+    if (existsSync18(handWritten)) {
+      const sql2 = readFileSync11(handWritten, "utf8");
       if (splitStatements(sql2).length === 0) {
         throw new Error(`Can't roll back ${name}: migrations/down/${name} has no SQL statements yet. Write the rollback SQL, then run the rollback again. Nothing was changed.`);
       }
       plan.push({ name, sql: sql2, source: `migrations/down/${name}` });
       continue;
     }
-    const upPath = join16(migrationsDir, name);
-    if (!existsSync17(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
-    const down = deriveDown(readFileSync10(upPath, "utf8"));
+    const upPath = join17(migrationsDir, name);
+    if (!existsSync18(upPath)) throw new Error(`${name} was applied but migrations/${name} is missing, so it can't be reversed.`);
+    const down = deriveDown(readFileSync11(upPath, "utf8"));
     if (!down.reversible) {
       throw new Error(
         `Can't roll back ${name}: ${down.reason}
@@ -3194,37 +3388,37 @@ Write the reverse SQL to migrations/down/${name} and run the rollback again. Not
     }
     plan.push({ name, sql: down.sql, source: "derived" });
   }
-  log(`${pc11.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
+  log(`${pc12.bold(`Rolling back ${plan.length} migration(s) on ${db.database_name} (${where}):`)}`);
   for (const step of plan) {
-    log(`  ${step.name} ${pc11.dim(`(${step.source})`)}`);
-    for (const line of step.sql.trim().split("\n")) log(pc11.dim(`    ${line}`));
+    log(`  ${step.name} ${pc12.dim(`(${step.source})`)}`);
+    for (const line of step.sql.trim().split("\n")) log(pc12.dim(`    ${line}`));
   }
   if (options2.remote && !options2.yes) {
-    log(pc11.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
+    log(pc12.yellow("\nThis changes the remote database. Re-run with --yes to proceed."));
     return 1;
   }
   const script = plan.map(({ name, sql: sql2 }) => `${sql2.trim()}
 DELETE FROM d1_migrations WHERE name = '${name.replace(/'/g, "''")}';`).join("\n") + "\n";
-  const dir = mkdtempSync(join16(tmpdir(), "flare-rollback-"));
+  const dir = mkdtempSync(join17(tmpdir(), "flare-rollback-"));
   try {
-    const file = join16(dir, "rollback.sql");
-    writeFileSync11(file, script);
+    const file = join17(dir, "rollback.sql");
+    writeFileSync12(file, script);
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Rollback failed:
 ${result.output.trim()}`);
   } finally {
     rmSync2(dir, { recursive: true, force: true });
   }
-  log(pc11.green(`
+  log(pc12.green(`
 Rolled back ${plan.map((step) => step.name).join(", ")}.`));
   return 0;
 }
 
 // src/commands/rm.ts
-import { existsSync as existsSync18, readdirSync as readdirSync7, readFileSync as readFileSync11, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname10, join as join17 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync7, readFileSync as readFileSync12, rmdirSync, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join18 } from "path";
 import { relationGraph as relationGraph3 } from "@flaredev/core";
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 var squash = (text) => text.replace(/\r\n/g, "\n").replace(/\s+/g, " ").trim();
 function handWrittenReason(source, header, options2 = {}) {
   const parts = splitMarkers(source);
@@ -3241,10 +3435,10 @@ function handWrittenReason(source, header, options2 = {}) {
   return null;
 }
 function removeEmptyDirs(appRoot, start) {
-  let dir = dirname10(join17(appRoot, start));
-  const roots = [join17(appRoot, "app", "api"), join17(appRoot, "app", "admin")];
+  let dir = dirname10(join18(appRoot, start));
+  const roots = [join18(appRoot, "app", "api"), join18(appRoot, "app", "admin")];
   const inside = () => roots.some((root) => dir.startsWith(root) && dir !== root);
-  while (inside() && existsSync18(dir) && readdirSync7(dir).length === 0) {
+  while (inside() && existsSync19(dir) && readdirSync7(dir).length === 0) {
     rmdirSync(dir);
     dir = dirname10(dir);
   }
@@ -3273,7 +3467,7 @@ async function rmResource(rawName, options2 = {}) {
   if (entry) {
     owned.add(entry.file);
     for (const file of planFiles(all)) {
-      if (existsSync18(join17(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
+      if (existsSync19(join18(appRoot, file.path)) && file.header === resourceHeader(name)) owned.add(file.path);
     }
   }
   for (const orphan of findOrphans(appRoot, remaining)) if (orphan.resource === name) owned.add(orphan.path);
@@ -3282,7 +3476,7 @@ async function rmResource(rawName, options2 = {}) {
   if (!entry && owned.size === 0) throw new Error(`No resource "${name}" (no ${descriptorPath(name)} and no generated files).`);
   const findings = [];
   for (const path of owned) {
-    const source = readFileSync11(join17(appRoot, path), "utf8");
+    const source = readFileSync12(join18(appRoot, path), "utf8");
     let wrapper;
     if (entry && path === entry.file) {
       const standard = splitMarkers(renderDescriptor(name, [{ key: "placeholder", kind: "string", required: true, unique: false }]));
@@ -3303,34 +3497,34 @@ Move what you want to keep, or pass --force to delete anyway.`);
   }
   const removed = [...owned].sort();
   for (const path of removed) {
-    unlinkSync2(join17(appRoot, path));
+    unlinkSync2(join18(appRoot, path));
     removeEmptyDirs(appRoot, path);
-    log(`${pc12.red("remove".padEnd(9))} ${path}`);
+    log(`${pc13.red("remove".padEnd(9))} ${path}`);
   }
   logResults(applyPlan(appRoot, planFiles(remaining, policy ? await loadPolicies(appRoot) : void 0)), log);
   const table = entry ? tableExport(entry.resource) : void 0;
-  if (table && existsSync18(join17(appRoot, "seeds"))) {
-    const seeds = readdirSync7(join17(appRoot, "seeds")).filter(
-      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync11(join17(appRoot, "seeds", file), "utf8"))
+  if (table && existsSync19(join18(appRoot, "seeds"))) {
+    const seeds = readdirSync7(join18(appRoot, "seeds")).filter(
+      (file) => new RegExp(`\\b${table}\\b`).test(readFileSync12(join18(appRoot, "seeds", file), "utf8"))
     );
-    if (seeds.length) log(pc12.yellow(`
+    if (seeds.length) log(pc13.yellow(`
 These seeds still use ${table}: ${seeds.map((s) => `seeds/${s}`).join(", ")}.`));
   }
   let migrations = [];
   if (!options2.skipMigration && entry) {
     const result = await generateSchemaMigration(appRoot, `drop_${entry.resource.table}`);
     migrations = result.files;
-    for (const file of migrations) log(`${pc12.green("create".padEnd(9))} ${file}`);
-    for (const repair of result.repairs) log(pc12.dim(`repaired  ${repair}`));
+    for (const file of migrations) log(`${pc13.green("create".padEnd(9))} ${file}`);
+    for (const repair of result.repairs) log(pc13.dim(`repaired  ${repair}`));
     if (migrations.length) log(`
-Next: ${pc12.bold("flare migrate")} to drop the table locally.`);
+Next: ${pc13.bold("flare migrate")} to drop the table locally.`);
   }
   return { removed, migrations };
 }
 
 // src/commands/role.ts
 import { humanize } from "@flaredev/core";
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
 function roleInsertSql(name, label) {
   if (!ROLE_NAME.test(name)) throw new Error(`Invalid role "${name}". Use lowercase letters, digits, _ or -, e.g. admin or support-agent.`);
@@ -3375,24 +3569,24 @@ ${result.output.trim()}`);
   }
   const [first] = extractJson(result.output);
   const added = first?.results?.[0];
-  log(pc13.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
-  log(pc13.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
+  log(pc14.green(`Role "${added?.name ?? name}" registered (${options2.remote ? "remote" : "local"}).`));
+  log(pc14.dim(`Assign it with: flare user:role <email> ${added?.name ?? name}${options2.remote ? " --remote" : ""}`));
   return 0;
 }
 
 // src/commands/seed.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync10, readdirSync as readdirSync8, writeFileSync as writeFileSync13 } from "fs";
 import { createRequire } from "module";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { pathToFileURL } from "url";
 import { kebabCase as kebabCase3, storedFields as storedFields2 } from "@flaredev/core";
 import { createJiti as createJiti4 } from "jiti";
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 var SEEDS_DIR = "seeds";
 var LOCAL_STATE = ".wrangler/state/v3";
 function seedFiles(appRoot, names) {
-  const dir = join18(appRoot, SEEDS_DIR);
-  const all = existsSync19(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
+  const dir = join19(appRoot, SEEDS_DIR);
+  const all = existsSync20(dir) ? readdirSync8(dir).filter((file) => file.endsWith(".seed.ts")).sort() : [];
   if (!names?.length) return all;
   return names.map((name) => {
     const file = `${name.replace(/\.seed\.ts$/, "")}.seed.ts`;
@@ -3407,29 +3601,29 @@ async function runSeeds(options2 = {}) {
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const files = seedFiles(appRoot, options2.names);
   if (files.length === 0) {
-    log(`No seeds found. Create one with ${pc14.bold("flare seed:make <name>")}.`);
+    log(`No seeds found. Create one with ${pc15.bold("flare seed:make <name>")}.`);
     return;
   }
-  const jiti = createJiti4(join18(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
-  const appRequire = createRequire(join18(appRoot, "package.json"));
+  const jiti = createJiti4(join19(appRoot, "package.json"), { alias: { "@": appRoot }, moduleCache: false, fsCache: false });
+  const appRequire = createRequire(join19(appRoot, "package.json"));
   const wrangler = await import(pathToFileURL(appRequire.resolve("wrangler")).href);
   const { drizzle } = await jiti.import("drizzle-orm/d1");
-  const schema = await jiti.import(join18(appRoot, "db/schema.ts"));
+  const schema = await jiti.import(join19(appRoot, "db/schema.ts"));
   const { env, dispose } = await wrangler.getPlatformProxy({
-    configPath: join18(appRoot, "wrangler.jsonc"),
-    persist: { path: join18(appRoot, LOCAL_STATE) }
+    configPath: join19(appRoot, "wrangler.jsonc"),
+    persist: { path: join19(appRoot, LOCAL_STATE) }
   });
   try {
     const bindings = env;
     if (!bindings.DB) throw new Error("No DB binding found in wrangler.jsonc.");
     const db = drizzle(bindings.DB, { schema });
     for (const file of files) {
-      const mod = await jiti.import(join18(appRoot, SEEDS_DIR, file));
+      const mod = await jiti.import(join19(appRoot, SEEDS_DIR, file));
       if (typeof mod.default !== "function") throw new Error(`${SEEDS_DIR}/${file} must \`export default defineSeed(async ({ db }) => { ... })\`.`);
-      log(`${pc14.cyan("seed")} ${file}`);
+      log(`${pc15.cyan("seed")} ${file}`);
       await mod.default({ db, env: bindings, log: (message) => log(`  ${message}`) });
     }
-    log(pc14.green(`
+    log(pc15.green(`
 Ran ${files.length} seed(s) against the local database.`));
   } finally {
     await dispose();
@@ -3440,6 +3634,11 @@ function sampleValue(key, def, row) {
     case "string":
       if (def.format === "email") return `\`${kebabCase3(key).replace(/-?email$/, "") || "user"}\${i}@example.com\``;
       if (def.format === "url") return `\`https://example.com/\${i}\``;
+      if (def.format === "tel") return `\`+1202555\${String(1000 + i).slice(-4)}\``;
+      if (def.format === "domain") return `\`example\${i}.com\``;
+      if (def.format === "country") return JSON.stringify(["US", "GB", "UG", "KE", "DE"][row % 5]);
+      if (def.format === "color") return JSON.stringify("#f2541d");
+      if (def.format === "slug") return `\`${kebabCase3(def.label ?? key)}-\${i}\``;
       return `\`${def.label} \${i}\``;
     case "text":
       return `"Lorem ipsum dolor sit amet."`;
@@ -3455,6 +3654,8 @@ function sampleValue(key, def, row) {
       return "new Date().toISOString()";
     case "enum":
       return JSON.stringify(def.options[row % def.options.length]);
+    case "multiselect":
+      return JSON.stringify(def.options.slice(0, Math.max(1, def.minItems ?? 1)));
     case "file":
       return void 0;
     case "belongsTo":
@@ -3498,8 +3699,8 @@ async function makeSeed(rawName, options2 = {}) {
   const name = kebabCase3(rawName);
   if (!name) throw new Error(`Invalid seed name "${rawName}".`);
   const relative2 = `${SEEDS_DIR}/${name}.seed.ts`;
-  const path = join18(appRoot, relative2);
-  if (existsSync19(path)) throw new Error(`${relative2} already exists.`);
+  const path = join19(appRoot, relative2);
+  if (existsSync20(path)) throw new Error(`${relative2} already exists.`);
   const resources = (await loadResources(appRoot)).map(({ resource: resource2 }) => resource2);
   let resource;
   if (options2.resource) {
@@ -3508,27 +3709,27 @@ async function makeSeed(rawName, options2 = {}) {
   } else {
     resource = resources.find((r) => [kebabCase3(r.name), r.slug].includes(name));
   }
-  mkdirSync10(join18(appRoot, SEEDS_DIR), { recursive: true });
-  writeFileSync12(path, renderSeed(resource));
-  log(`${pc14.green("create".padEnd(9))} ${relative2}`);
+  mkdirSync10(join19(appRoot, SEEDS_DIR), { recursive: true });
+  writeFileSync13(path, renderSeed(resource));
+  log(`${pc15.green("create".padEnd(9))} ${relative2}`);
   log(`
-Run it with ${pc14.bold(`flare seed ${name}`)}.`);
+Run it with ${pc15.bold(`flare seed ${name}`)}.`);
   return relative2;
 }
 
 // src/commands/billing-sync.ts
 import { createRequire as createRequire2 } from "module";
-import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync21, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { kebabCase as kebabCase4 } from "@flaredev/core";
-import pc15 from "picocolors";
+import pc16 from "picocolors";
 function stripeKeys(appRoot) {
   const map = {};
-  const path = join19(appRoot, ".dev.vars");
-  if (existsSync20(path)) {
-    for (const line of readFileSync12(path, "utf8").split(/\r?\n/)) {
+  const path = join20(appRoot, ".dev.vars");
+  if (existsSync21(path)) {
+    for (const line of readFileSync13(path, "utf8").split(/\r?\n/)) {
       const match = /^\s*([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
       if (match) map[match[1]] = match[2].trim();
     }
@@ -3611,10 +3812,10 @@ async function syncPlans(options2 = {}) {
   if (!key) throw new Error("STRIPE_SECRET_KEY is not set in .dev.vars or the environment.");
   const db = readD1Databases(appRoot)[0];
   if (!db) throw new Error("No d1_databases in wrangler.jsonc.");
-  const appRequire = createRequire2(join19(appRoot, "package.json"));
+  const appRequire = createRequire2(join20(appRoot, "package.json"));
   const stripeModule = await import(pathToFileURL2(appRequire.resolve("stripe")).href);
   const stripe = new stripeModule.default(key, { apiVersion: "2026-08-26.dahlia" });
-  const appName = JSON.parse(readFileSync12(join19(appRoot, "package.json"), "utf8")).name ?? "app";
+  const appName = JSON.parse(readFileSync13(join20(appRoot, "package.json"), "utf8")).name ?? "app";
   const everything = await stripe.products.list({ active: true, limit: 100 }).autoPagingToArray({ limit: 1e4 });
   const products = options2.all ? everything : everything.filter((product) => product.metadata?.flare_app === appName);
   if (products.length === 0) {
@@ -3635,10 +3836,10 @@ async function syncPlans(options2 = {}) {
 ${existingResult.output.trim()}`);
   }
   const known = new Set(extractJson(existingResult.output)[0]?.results.map((row) => row.stripe_price_id));
-  const dir = mkdtempSync2(join19(tmpdir2(), "flare-sync-"));
+  const dir = mkdtempSync2(join20(tmpdir2(), "flare-sync-"));
   try {
-    const file = join19(dir, "sync-plans.sql");
-    writeFileSync13(file, renderSyncSql(rows));
+    const file = join20(dir, "sync-plans.sql");
+    writeFileSync14(file, renderSyncSql(rows));
     const result = await runWrangler(wrangler, ["d1", "execute", db.binding, ...target, "--file", file], appRoot, { capture: true });
     if (result.code !== 0) throw new Error(`Could not write plans:
 ${result.output.trim()}`);
@@ -3650,26 +3851,26 @@ ${result.output.trim()}`);
     const isNew = !known.has(row.stripePriceId);
     if (isNew) created++;
     const price = `${row.currency.toUpperCase()} ${(row.amount / 100).toFixed(2)}${row.interval ? `/${row.interval}` : " once"}`;
-    log(`${(isNew ? pc15.green("create") : pc15.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc15.dim(price)}`);
+    log(`${(isNew ? pc16.green("create") : pc16.dim("update")).padEnd(18)} ${row.name} (${row.slug}) ${pc16.dim(price)}`);
   }
-  for (const name of skipped) log(pc15.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
+  for (const name of skipped) log(pc16.yellow(`skipped  ${name}: only monthly, yearly and one-time prices become plans`));
   const configuration = await syncPortalConfiguration(stripe, rows, appName);
-  if (configuration) log(`${pc15.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
-  log(pc15.green(`
+  if (configuration) log(`${pc16.dim("portal".padEnd(9))} plan changes enabled for ${new Set(rows.filter((row) => row.interval).map((row) => row.stripeProductId)).size} product(s) (${configuration})`);
+  log(pc16.green(`
 ${rows.length} plan(s) synced to the ${options2.remote ? "remote" : "local"} database; plans no longer active in Stripe were deactivated.`));
   return { created, updated: rows.length - created, skipped };
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join20 } from "path";
-import pc16 from "picocolors";
+import { existsSync as existsSync22 } from "fs";
+import { join as join21 } from "path";
+import pc17 from "picocolors";
 async function syncTypes(options2 = {}) {
   const log = options2.log ?? ((message) => console.log(message));
   const appRoot = findAppRoot(options2.cwd ?? process.cwd());
   const all = await loadResources(appRoot);
   const policies = await loadPolicies(appRoot);
-  const tracksPolicies = policies.length > 0 || existsSync21(join20(appRoot, "policies/index.ts"));
+  const tracksPolicies = policies.length > 0 || existsSync22(join21(appRoot, "policies/index.ts"));
   const plan = planFiles(all, tracksPolicies ? policies : void 0);
   if (!options2.check) ensureSupportFiles(appRoot, log);
   const results = applyPlan(appRoot, plan, { force: options2.force, dryRun: options2.check });
@@ -3681,42 +3882,42 @@ async function syncTypes(options2 = {}) {
   if (drift.length) {
     log(
       `
-${pc16.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
+${pc17.red("Drift:")} ${drift.length} generated block(s) were edited by hand and were ${options2.check ? "not checked further" : "left unchanged"}.
 Move custom code outside the // generated:start \u2026 // generated:end block, or re-run with --force to overwrite.`
     );
   }
   if (unmarked.length) {
     log(`
-${pc16.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
+${pc17.red("Conflict:")} ${unmarked.map((r) => r.path).join(", ")} exist without a generated block (hand-written). Rename or remove them.`);
   }
   if (orphans.length) {
     const resources = [...new Set(orphans.map((o) => o.resource))];
     log(`
-${pc16.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
+${pc17.yellow("Orphaned:")} generated files the descriptors no longer produce (${resources.join(", ")}):`);
     for (const orphan of orphans) log(`  ${orphan.path}`);
     log(
-      `If the resource was deleted, remove them with ${pc16.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
+      `If the resource was deleted, remove them with ${pc17.bold(`flare rm resource ${resources[0]}`)}; if it was renamed (table or slug), delete the old files.`
     );
   }
   const tablesChanged = changed.some((r) => r.path.startsWith("db/schema/") && (r.status === "outdated" || r.status === "missing"));
   if (tablesChanged && !options2.check) {
     log(`
-${pc16.cyan("Tables changed.")} Create a migration with ${pc16.bold("flare gen migration <name> --from-schema")}, then ${pc16.bold("flare migrate")}.`);
+${pc17.cyan("Tables changed.")} Create a migration with ${pc17.bold("flare gen migration <name> --from-schema")}, then ${pc17.bold("flare migrate")}.`);
   }
   const problems = drift.length + unmarked.length + orphans.length;
   if (options2.check) {
     const stale = changed.length;
-    if (stale === 0 && problems === 0) log(pc16.green("Generated files are in sync with the resource descriptors."));
+    if (stale === 0 && problems === 0) log(pc17.green("Generated files are in sync with the resource descriptors."));
     else log(`
-${pc16.red("Out of sync:")} ${stale} file(s) would change. Run ${pc16.bold("flare sync-types")}.`);
+${pc17.red("Out of sync:")} ${stale} file(s) would change. Run ${pc17.bold("flare sync-types")}.`);
     return stale + problems > 0 ? 1 : 0;
   }
-  if (changed.length === 0 && problems === 0) log(pc16.green("Everything is in sync."));
+  if (changed.length === 0 && problems === 0) log(pc17.green("Everything is in sync."));
   return problems > 0 ? 1 : 0;
 }
 
 // src/commands/user-role.ts
-import pc17 from "picocolors";
+import pc18 from "picocolors";
 var ROLE = /^[a-z][a-z0-9_-]{0,31}$/;
 var EMAIL = /^[^\s@'"\\]+@[^\s@'"\\]+\.[^\s@'"\\]+$/;
 function userRoleSql(email, role) {
@@ -3730,8 +3931,8 @@ async function setUserRole(email, role, options2 = {}) {
   const sql2 = userRoleSql(email, role);
   const roles = await listRoles(options2);
   if (roles && !roles.includes(role)) {
-    log(pc17.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
-    log(pc17.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
+    log(pc18.red(`No role "${role}" is registered. Known roles: ${roles.join(", ") || "none"}.`));
+    log(pc18.dim(`Register it with: flare role:add ${role}${options2.remote ? " --remote" : ""}`));
     return 1;
   }
   const db = readD1Databases(appRoot)[0];
@@ -3745,22 +3946,24 @@ ${result.output.trim()}`);
   const [first] = extractJson(result.output);
   const updated = first?.results ?? [];
   if (updated.length === 0) {
-    log(pc17.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
+    log(pc18.red(`No user with email ${email} in the ${options2.remote ? "remote" : "local"} database. Sign up first, then run this again.`));
     return 1;
   }
-  log(pc17.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
+  log(pc18.green(`${updated[0].email} now has role "${updated[0].role}" (${options2.remote ? "remote" : "local"}).`));
   return 0;
 }
 
 // src/cli.ts
 function createCli() {
   const cli = cac("flare");
-  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--auth-providers <list>", "OAuth providers to scaffold, comma-separated (google, github)").option("--skip-install", "Write files without installing dependencies").example("flare create shop --auth-providers google,github").action((dir, options2) => {
+  cli.command("create <dir>", "Scaffold a new Flare app").option("--pm <manager>", "Package manager: pnpm, npm, yarn, or bun (default: detected)").option("--theme <name>", "Look of the app: default, coral, amber, sky, mono or emerald").option("--auth <list>", "Sign-in methods: magic-link, email-otp, passkeys, 2fa-app, 2fa-email, all or none (default: all)").option("--auth-providers <list>", "Social sign-in, comma-separated: google, github, apple, microsoft").option("-y, --yes", "Don't ask: use the flags given and the defaults for the rest").option("--skip-install", "Write files without installing dependencies").example("flare create shop").example("flare create shop --theme mono --auth passkeys,2fa-app --auth-providers google,github --yes").action(async (dir, options2) => {
     const install = !options2.skipInstall;
-    const result = createApp(dir, { pm: options2.pm, install, authProviders: options2.authProviders });
+    let answers = { theme: options2.theme, auth: options2.auth, authProviders: options2.authProviders };
+    if (canPrompt(options2.yes)) answers = await askCreateQuestions(answers);
+    const result = createApp(dir, { pm: options2.pm, install, ...answers });
     printNextSteps(result, install);
   });
-  cli.command("gen <generator> [name]", "Generate code. Generators: resource, migration, policy, billing, security").option("--fields <fields>", 'resource: fields, e.g. "name:string, email:string!, status:enum(lead,customer)"').option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example('flare gen resource Contact --fields "name:string, email:string!, company:belongsTo(Company)?"').example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
+  cli.command("gen <generator> [name]", "Generate code. Generators: resource, migration, policy, billing, security").option("--fields <fields>", "resource: fields, e.g. 'name:string, email:string!, status:enum(lead,customer)' (single quotes: bash treats ! in double quotes as history)").option("--force", "resource/policy/billing/security: overwrite hand-edited generated blocks").option("--from-schema", "migration: diff the current tables instead of a blank migration").option("--roles <roles>", "policy: roles allowed to read, create and update, e.g. admin,staff").option("--delete-roles <roles>", "policy: roles allowed to delete (default: the first --roles entry)").option("--provider <provider>", "billing: payment provider (default: stripe)").option("--mode <mode>", "billing: subscriptions (the default; includes one-time checkout)").option("--skip-install", "billing: write files without installing the stripe dependency").option("--skip-migration", "billing/security: skip generating the schema migration").example("flare gen resource Contact --fields 'name:string, email:string!, company:belongsTo(Company)?'").example("flare gen migration backfill_contact_status").example("flare gen migration add_phone_to_contacts --from-schema").example("flare gen policy Invoice --roles admin,staff --delete-roles admin").example("flare gen billing --provider stripe --mode subscriptions").example("flare gen security").action(
     async (generator, name, options2) => {
       if (generator === "billing")
         return genBilling({ provider: options2.provider, mode: options2.mode, force: options2.force, skipInstall: options2.skipInstall, skipMigration: options2.skipMigration });
@@ -3802,6 +4005,7 @@ function createCli() {
   cli.command("sync-types", "Regenerate schema, routes, clients, and validators from resource descriptors; report drift").option("--check", "Change nothing; exit 1 if anything is out of sync (CI)").option("--force", "Overwrite generated blocks that were edited by hand").action(async (options2) => {
     process.exitCode = await syncTypes(options2);
   });
+  cli.command("theme [name]", "List the themes, or switch the app to one: default, coral, amber, sky, mono, emerald").example("flare theme").example("flare theme mono").action((name) => setTheme(name));
   cli.command("tunnel [target]", "Share a local server on a public https://*.trycloudflare.com URL (Cloudflare Quick Tunnel; no account needed)").example("flare tunnel          # http://localhost:3000").example("flare tunnel 8787").example("flare tunnel http://localhost:5173").action(async (target) => {
     const local = toLocalUrl(target);
     const tunnel = await openTunnel(local);
@@ -3837,6 +4041,6 @@ try {
     }
   }
 } catch (error) {
-  console.error(pc18.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
+  console.error(pc19.red(`\u2716 ${error instanceof Error ? error.message : String(error)}`));
   process.exitCode = 1;
 }